Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This package includes outdated registered functions for spaCy v3.x, for example model architectures, pipeline components and utilities. It's installed automatically as a dependency of spaCy, and allows us to provide backwards compatibility, while keeping the core library tidy and up to date. All of this happens under the hood, so you typically shouldn't have to care about this package.
Whenever a new backwards-incompatible version of a registered function is available, e.g. spacy.Tok2Vec.v1
→ spacy.Tok2Vec.v2
, the legacy version is moved to spacy-legacy
, and exposed via entry points. This means that it will still be available if your config files use it, even though the core library only includes the latest version.
Legacy functions are exposed with the prefix spacy-legacy
, e.g. spacy-legacy.Tok2Vec.v1
. When spaCy resolves your config and a function is not available in the core library, e.g. spacy.Tok2Vec.v1
, it will check if there's a legacy function available and fall back to that. You can also explicitly refer to legacy functions in your config, to indicate that a newer version is available.
FAQs
Legacy registered functions for spaCy backwards compatibility
We found that spacy-legacy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.